- Freeradius-Users - lists.freeradius.org

1.1.2 compile issues on Solaris
by Rob Shepherd 12 Jul '06

12 Jul '06

Hi freeradius, 1.1.2 won't compile on Solaris/GCC I gather this is a known issue. something to do with closefrom return type. What does to community suggest I do? use CVS? downgrade? wait for 1.1.3? apply a patch? regards and thanks rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

2 1

Framed-IP-Address accounted in Hex
by Graeme Hinchliffe 12 Jul '06

12 Jul '06

Hi, I have just (as of yesterday) upgraded FreeRADIUS from 1.0.3 to 1.1.2 keeping all the same config files. I am running it on a Debian Woody system and using Postgres 7.4.7 as the database. This particular box is solely for RADACCT and only uses RADIUS as a test to test the state of the service/db for health checks. I have postgres configured to dump any SQL lines which throw up an error and I have seen a large number being logged failing to insert the Framed-IP-Address attribute, in the dumped SQL string the IP Address is a hex value instead of a dotted quad which fails the insert. The RADACCT packets causing this are not just coming from one NAS either, and accounting still seems to be happening on the most part. any ideas? or have i found a bug ? thanks ----- Graeme Hinchliffe (BSc) Core Systems Designer Zen Internet (http://www.zen.co.uk/) Direct: 0845 058 9074 Main : 0845 058 9000 Fax : 0845 058 9005

2 11

freeradius and router problem
by Moustapha Ould Maouloud 12 Jul '06

12 Jul '06

Hello, I have in my LAN a AC Access Conroller (IP: 192.168.10.80; gw: 192.168.10.1 /83.B.C.D) which I authenticate on a freeradius via Internet (IP of this server: 63.E.F.G). My server receives : access-request from 63.E.F.G:10980 . and fact: sending access accept to 63.E.F.G: 10980 My problem is that: the response of the radius does not reach AC (IP 192.168.10.80) although the answer was indeed turned over to my router!!! Someone can help me? Please Thanks; MOM --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

1 1

Re: Problem with rlm_perl
by Boian Jordanov 12 Jul '06

12 Jul '06

Hi please use mailing list instead of writing to me directly. Regarding the trouble try reinstalling the Data::Dumper module and check that it is linked with correct perl library. On Wednesday 12 July 2006 03:09, you wrote: > Hello! > > I have a problem with rlm_perl. > > My Linux box is Debian Sarge (perl 5.8.4-8sarge4 from Debian packages), > with FreeRADIUS 1.1.2 compiled from source (using debian/rules). > > Debug output from freeradius is: > > Wed Jul 12 02:07:28 2006 : Debug: Module: Loaded perl > Wed Jul 12 02:07:28 2006 : Debug: perl: module = "/root/bin/alfatelkom.pm" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_authorize = "authorize" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_authenticate = "authenticate" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_accounting = "accounting" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_preacct = "preacct" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_checksimul = "checksimul" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_detach = "detach" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_xlat = "xlat" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_pre_proxy = "pre_proxy" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_post_proxy = "post_proxy" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_post_auth = "post_auth" > Wed Jul 12 02:07:28 2006 : Debug: perl: perl_flags = "(null)" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_start_accounting = "(null)" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_stop_accounting = "(null)" > Can't load '/usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so' for module > Data::Dumper: /usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so: undefined > symbol: Perl_sv_cmp at /usr/lib/perl/5.8/XSLoader.pm line 68. at > /usr/lib/perl/5.8/Data/Dumper.pm line 27 > Compilation failed in require at /root/bin/alfatelkom.pm line 30. > BEGIN failed--compilation aborted at /root/bin/alfatelkom.pm line 30. > Wed Jul 12 02:07:28 2006 : Error: rlm_perl: perl_parse failed: > /root/bin/alfatelkom.pm not found or has syntax errors. Wed Jul 12 02:07:28 > 2006 : Error: radiusd.conf[540]: perl: Module instantiation failed. Wed Jul > 12 02:07:28 2006 : Error: radiusd.conf[1747] Unknown module "perl". Wed Jul > 12 02:07:28 2006 : Error: radiusd.conf[1746] Failed to parse authenticate > section. > > Thanks in advance, > Ivan Rako > University Computing Centre, Zagreb -- Best Regards, Boian Jordanov SNE Orbitel - Next Generation Telecom tel. +359 2 4004 723 tel. +359 2 4004 002

1 0

Handling request from OpenSer in Freeradius - I need help
by GlobeInPhotos 12 Jul '06

12 Jul '06

Hi I have problem to properly handle OpenSer request in Freeradius. When I switch on debug mode in freeradius I've got LISTING 1 (below). In the first part of log we can see that INVITE message was received and authorize_check (defined by _check_query ) SQL statement was called and I've got proper result. After that message was parsed and values from Digest-Attributes was moved to named Digest- attributes e.g Digest-Method In my radius solution I have to return to OpenSer few attributes when I detect that Digest-Method is equal to INVITE. But I cannot return attributes by authorize_check because when authotize_check db procedure is called Digest-Method is not set (only I can see Digest-Attributes). After call to authorize_check, freeradius parse request and I have complete set of values: Digest-User-Name = "test001" Digest-Realm = "server1.test.pl" Digest-Nonce = "44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-URI = "sip:+4800001@server1.test.pl" Digest-Method = "INVITE" But after this part only one DB procedure is called: test.postauth() (defined by postauth_query in postgres.sql) but this procedure cannot return attributes - It can returns only one string. I have questions: - how to return list attributes when message is parsed ? Is it possible to configure that radius will call sql statement after parsing a message - how to access all Digest-Attrbute from unparsed message when I put '%{Digest-Attributes}' in query I can see only first attribute - Is possible to control order of parsing in my example orders is: - receive of 'raw' request - execution authorize check - parsing of raw message (message "mod_digest: Converting Digest-Attributes to something sane") But in post http://lists.freeradius.org/mailman/htdig/freeradius-users/2004-September/03 6519.html order is following - receive of 'raw' request - parsing of raw message (message "mod_digest: Converting Digest-Attributes to something sane") - execution authorize check Do you know how to achieve last order ? Should I change something in conf. files? Part of my postgres.conf file: authorize_check_query = "SELECT * FROM test.authorize_check('%{SQL-User-Name}', '%{Digest-URI}', '%{Service-Type}')" postauth_query = "SELECT test.postauth('%{Digest-Method}', '%{Digest-Attributes:-0}', '%{Digest-Attributes:-3}')" LISTING 1 --------- rad_recv: Access-Request packet from host 153.19.130.250:34032, id=245, length=237 User-Name = "test001(a)server1.test.pl" Digest-Attributes = "\n\ttest001" Digest-Attributes = "\001\026server1.test.pl" Digest-Attributes = "\002*44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-Attributes = "\004#sip:+4800001@server1.test.pl" Digest-Attributes = "\003\010INVITE" Digest-Response = "1475e3bd94becc734d77893ddcd70046" Service-Type = IAPP-Register Sip-URI-User = "test001" NAS-Port = 5060 NAS-IP-Address = 153.19.130.250 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_realm: Looking up realm "server1.test.pl" for User-Name = "test001(a)server1.test.pl" rlm_realm: No such realm "server1.test.pl" modcall[authorize]: module "suffix" returns noop for request 3 users: Matched entry DEFAULT at line 5 users: Matched entry DEFAULT at line 42 modcall[authorize]: module "files" returns ok for request 3 radius_xlat: 'test001(a)server1.test.pl' rlm_sql (sql): sql_set_user escaped user --> 'test001(a)server1.test.pl' radius_xlat: 'SELECT * FROM test.authorize_check('test001(a)server1.test.pl', '', '')' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT * FROM test.authorize_check('test001(a)server1.test.pl', '', '') rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' radius_xlat: '' radius_xlat: '' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "test001" Digest-Realm = "server1.test.pl" Digest-Nonce = "44b414bb1e6165386992a6c367a1ce2b1682ba32" Digest-URI = "sip:+4800001@server1.test.pl" Digest-Method = "INVITE" A1 = test001:server1.test.pl:gdfi A2 = INVITE:sip:+4800001@server1.test.pl H(A1) = 1307e5525ca6a7907307ad0af15dbb42 H(A2) = 5bfbcc6c93b4debf70853f609176ff45 KD = 1307e5525ca6a7907307ad0af15dbb42:44b414bb1e6165386992a6c367a1ce2b1682ba32:5b fbcc6c93b4debf70853f609176ff45 EXPECTED 1475e3bd94becc734d77893ddcd70046 RECEIVED 1475e3bd94becc734d77893ddcd70046 modcall[authenticate]: module "digest" returns ok for request 3 modcall: leaving group authenticate (returns ok) for request 3 Login OK: [test001(a)server1.test.pl/<no User-Password attribute>] (from client server1 port 5060) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 rlm_sql (sql): Processing sql_postauth radius_xlat: 'test001(a)server1.test.pl' rlm_sql (sql): sql_set_user escaped user --> 'test001(a)server1.test.pl' radius_xlat: 'SELECT test.postauth('=5Cn=5Cttest001', '=5Cn=5Cttest001', '=5Cn=5Cttest001')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is SELECT test.postauth('', '=5Cn=5Cttest001', '=5Cn=5Cttest001') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT test.postauth('', '=5Cn=5Cttest001', '=5Cn=5Cttest001') Regards Michal Szymanski -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.9.10/384 - Release Date: 2006-07-10

1 0

Ignoring unconnected handle 4..
by Abul Monsur Mannan 12 Jul '06

12 Jul '06

Hello FR users Can anyone here to light on me.My problem is -- [root@localhost ~]# radtest rumen rumen1 localhost 1812 testing123 Sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 ------------------------------------------------------ In radiusd -x command promp-- rad_recv: Access-Request packet from host 127.0.0.1:32769, id=66, length=57 User-Name = "rumen" User-Password = "rumen1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 23 modcall[authorize]: module "preprocess" returns ok for request 23 modcall[authorize]: module "chap" returns noop for request 23 modcall[authorize]: module "mschap" returns noop for request 23 rlm_realm: No '@' in User-Name = "rumen", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 23 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 23 radius_xlat: 'rumen' rlm_sql (sql): sql_set_user escaped user --> 'rumen' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rumen' ORDER BY id' rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 23 modcall: leaving group authorize (returns fail) for request 23 Finished request 23 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 23 ID 66 with timestamp 44b33d38 Nothing to do. Sleeping until we see a request. By the way ,I have username - rumen with password rumen1 in "radcheck" table in my mysql DB. Thank You in advance.

2 2

Username in MySQL with regexp
by christian meutes 11 Jul '06

11 Jul '06

Hello list, iam using FreeRADIUS-1.0.5 with MySQL-Backend. Now i want a username check with an regexp operator (=~), so that i can match usernames (+1234567(0-9)) against a regexp of "^\+^1234567" and dont have the need of creating 10 users which have all the same reply attributes. The Auth-Type of these usernames is always "Accept". How can i accomplish this? The username itself in the MySQL table doesnt has a check row.. Thanks for any help! Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

3 6

FreeRadius Autostart
by Wasif 11 Jul '06

11 Jul '06

Hi all, I am rephrasing my question. I installed FreeRadius without rpm package on CentOS 4. I want FreeRadius to start automatically in background when System boots up. Thanks Wazb

5 4

Freeradius and UUNet dial up
by Brenckle, Nicholas 11 Jul '06

11 Jul '06

Im having trouble configuring freeradius. Im going to give the full story, which might be too much detail but here goes... I have a radius server (freeradius v 0.7) working on an old box. I want to upgrade this to a new box with RHEL4 and Freeradius 1.0.1, that comes with RHEL4 now. The old configuration files would not just copy over, starting free radius gives errors with the dictionary files. Since I don't quite understand them, I thought better try to reconfigure the new version then just copy over configuration files. Now I have the new version running/authenticating. The problem is Im missing some data, I think. When I authenticate (using NTRadPing) off the old server, I get Sending authentication request to server 111.111.111.111:1812 Transmitting packet, code =1 id=4 length=67 received response from the server in 10 miliseconds reply packet code=2 id=4 length=174 response: Access-Accept -----------------------------------attribute dump ---------------------------------------------- Service-Type=Framed Framed-Protocol=PPP Ascend-Data-Filter=\0x01\0x01\0x00\0x00\0x00\0x00\0x00\0x00\0x00 (repeated lines) Ascent-Assign-IP-Pool=0 When I try against the new one, I get only the lines to "--attribute dump--", but I do get a correct auth. I know that part works because if I change the uname/password to wrong, it doesnt work. So it is correctly checking against LDAP. But I get none of the lower lines. I know the process is not quite right as If I add the lines to my hints file (which exists on the old server) DEFAULT Suffix == "@dial.dsl.net", Strip-User-Name = Yes Hint = "UUNetDial" then I get nothing working. If I comment out those lines, I can authenticate, but with no extra info. (Which I assume is part of the problem.) If I comment the hints lines out, I get this in the output of radiusd rlm_ldap: Bind was successful rlm_ldap: performing search in dc=dsl,dc=net, with filter (&(objectClass=dslnDialupUser)(uid=radius%dsl.net)) rlm_ldap: checking if remote access for radius%dsl.net is allowed by dslnRadiusProfile rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user radius%dsl.net authorized to use remote access if I leave those lines in the hints, it loses the uid, as shown below... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=dsl,dc=net, with filter (&(objectClass=dslnDialupUser)(uid=_)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed So, what I need to know is, why does the hint lines make the uid get stripped? Im guessing the system somewhere else is also doing a strip, and so the double means no UID gets there? Is there any "radius for dummies"? I think Im getting lost as to which process happens when during the process,ie: when does the hints vs clients vs users files come into play. Thanks for any help! Nick

1 0

Log Accountig users......
by Emerson 11 Jul '06

11 Jul '06

Hi, people, i mounted a freeradius and a NAS running linux with hostapd + wpa_supliccant and DHCP. My users authing with wifi 802.1X, always it work. But i need to know if the radius log the IP of user in accounting.....and save this on a table mysql ? Anyone make this work ? Thanks..... Emerson

2 1